The PNPT exam from TCM Security is a five-day simulated network penetration test, not a multiple-choice quiz. You get five (5) full days to compromise the exam network and two (2) additional days to write a professional report, then defend your findings in a live 15-minute debrief with senior penetration testers. The voucher costs $499, includes the full training bundle, and comes with a free retake if your first attempt falls short.
What the PNPT Exam Involves
The Practical Network Penetration Tester certification assesses a student’s ability to run an external and internal network penetration test at a professional level. To pass, you must use open-source intelligence to plan your approach, leverage Active Directory exploitation skills to bypass antivirus and egress filtering, move laterally and vertically through the network, and ultimately compromise the exam Domain Controller. There are no multiple-choice questions and no flags to collect: everything mirrors a real client engagement.
That realism is the point. A passing candidate can show an employer evidence of a complete engagement — scope, methodology, findings and remediation advice — rather than just a score report. If your goal is a credential that proves hands-on network attack skills at a moderate price, this format does it directly, and it rewards people who can write as well as hack.
What the $499 Voucher Buys
The voucher is valid for 12 months from the day of purchase and bundles 45+ hours of on-demand training across five courses: Practical Ethical Hacking, OSINT Fundamentals, the External Pentest Playbook, Linux Privilege Escalation and Windows Privilege Escalation. Access to the material starts on purchase day, so the clock on your training runs even before you schedule the exam. Military, veterans, students, teachers and first responders can claim a 20% discount by contacting TCM Security support with proof of status.
Failure does not double your bill: TCM includes one free retake with every voucher. The company states plainly that it does not want to profit on failure, so a rough first attempt costs you time rather than another exam fee. That policy matters when you compare lifetime cost across vendors, because re-purchasing failed attempts is where expensive exams get more expensive.
How the Report Debrief Works
Two of the exam’s days are reserved for writing. The report is not paperwork garnish; assessors grade it, and you must present it in a live 15-minute debrief in front of senior penetration testers who probe how you reached each finding. A technically clean attack with a weak report can still sink you, so treat reporting as a first-class skill, not an afterthought. Four habits consistently separate passing candidates:
- Log every step while you attack — commands, output, screenshots — instead of reconstructing them during reporting days.
- Follow a professional template: scope, methodology, risk-rated findings, evidence, remediation.
- Rehearse a tight walkthrough of your strongest findings before the debrief, timed to the minute.
- Prepare to explain why each exploit worked and what fixes it, not just which tool you ran.
PNPT vs OSCP Cost Comparison
The obvious rival is OffSec’s OSCP, and the economics differ sharply: the standalone OSCP+ exam costs $1,699 before any training, while the PEN-200 course bundles start at $1,749. OffSec also splits validity in two — the OSCP+ designation expires three (3) years after issuance while the base OSCP certification never expires — so a single pass earns a lifetime credential plus a three-year specialist badge.
The retake policies diverge too. The PNPT includes a free second attempt in the base price, whereas additional OffSec exam attempts are separate purchases. Here is the direct comparison:
| Factor | PNPT | OSCP+ |
|---|---|---|
| Voucher price | $499, training included | $1,699, exam only |
| Included with purchase | 45+ hours of training, 1 attempt, 1 free retake | Exam attempt; course access sold separately |
| Exam format | 5-day engagement, report, live debrief | Exploit-based practical plus report |
| Renewal | No renewal listed on vendor page | OSCP lifetime; OSCP+ renews every 3 years |
Who Should Take the PNPT
Choose the PNPT if you want an affordable, engagement-style exam that tests Active Directory attack chains, OSINT and report writing in one package, especially if you are targeting junior-to-mid pentest or red team roles where demonstrating a full engagement matters. Choose the OSCP instead if employer brand recognition outweighs cost: it remains the most frequently requested pentest credential in job listings, and many recruiters filter for it explicitly.
If you are still at the foundations stage, weigh cheaper groundwork first — for example, deciding whether the Google Cybersecurity Certificate is worth it for you — before committing to either hands-on exam. Also factor in post-exam logistics where they exist: some credentials carry paperwork long after the test, such as the CISSP endorsement window that runs for months after passing. The PNPT keeps this simple: once your report is accepted and your debrief is done, you are certified.
Sources
- TCM Security — PNPT certification page
- TCM Security — PNPT training and exam overview (PDF)
- OffSec — PEN-200 course page
- OffSec — OSCP+ standalone exam page